New network structure - questions

[nx]

Hi,

I have a very simple network setup that I want to make a little more complex. :e
The main change that I want to do is move 2 servers - a web app server and a db server -
to only connect from a reverse proxy (Pound) instead of being run off a shared switch as is the case now.

The first setup is working fine but the next setup has advantages:
- more reverse proxies can be run off Switch 1
- they can be separated by subnet address if needed
- Switch 2 can have multiple clones of web-server and db-servers running off it,
managed for load-bearing and fail-safe by Pound.

Here's the pretty diagram because my ascii version sucked:

I've looked at so many tut's and docs but I can't answer this basic freebsd question:

How do I get pound and/or freebsd to use eth3 when connecting to eth4
when pound redirects from 192.168.0.160:80 to 192.168.0.162:8080?

- Do I use ipfw to write a routing rule between eth2 and eth3?
If so, what would this look like? I've never written one!

- Does 192.168.0.160 have to be set as the gateway for 162 and 163?
That is, instead of using pfSense 192.168.0.254 as their gateway?

I know these are noob questions, and I shouldn't break what isn't broken,
but I want to move to this new setup as the short term pain will have long term gains, and I'm keen to learn anyway.

Thanks

 

[SirDice]

The two NICs on the reverse proxy host need to be in separate subnets.

 

[hblandford]

Renumber eth1 on the firewall and eth2 on the pound proxy to be on a different subnet... 192.168.1.x network.

Depending up how you want things to work, you might want to change the default gateway on the web and DB servers to be the pound box and put a route in the firewall box for 192.168.0.0/24 via the pound box. If you do this don't forget to add:

gateway_enable="YES"             # Set to YES if this host will be a gateway.

to /etc/rc.conf on the pound box.